Strategy for gaining ssh access without setting up a router

Question

I'm going to need to administrate someone's macbook pro remotely over ssh. Problem is, they'll be moving between networks so I can't just set up port forwarding on their router. What strategy could I use to gain access, regardless of the network they're on?

I'm thinking one possibility might be to get them to run a bash script (hopefully by double clicking on an icon on their desktop) which somehow made it possible for me to ssh in.

Perhaps something along the lines of https://github.com/progrium/localtunnel could do the job?

Thanks!

Answer 1

You're going to need the machine you'll be administering to make outbound connections in order to reach it behind whatever firewalls / routers it ends up behind. You might consider saving yourself the headache of implementing that yourself and use something like Hamachi.

Answer 2

Can you set up OpenVPN between the Macbook and your site? The Macbook can be an OpenVPN client using TunnelBlick. You can set up an OpenVPN server on your site using whatever is appropriate. In this case, the Macbook will initiate a VPN connection to your site, and your OpenVPN server will assign it a static IP address inside the VPN. You can then just ssh to that VPN IP address.

Yes, that localtunnel thing will probably work. On the other hand, OpenVPN is much more standardized and well understood than localtunnel. And you can do much more with it if you need additional access.

Answer 3

If you specifically need SSH, then some sort of VPN client on the Mac that links it to your network would allow this. When you need to get access, they fire up the VPN, which assigns them a static address on your network, then you SSH on.

Answer 4

As far as I'm concerned you can do that provided that:

1) you have public IP and sshd server running OR

2) if you are in intranet and you can set up port forwarding on your router so as port 22 will be redirected to your machine

if 1) or 2) are the case for you and macos machine has sshd server running. Do the following on macos whenever you want to have access to it (make script from it and give it to macos owners):

macos$ ssh -R 65022:localhost:22 root@<yourmachine_ip_address>

What it does is forwarding macos's sshd server on your port 65022.

Now you can simply ssh to port 65022:

yourlocalmachine$ ssh -p 65022 [email protected]

and you should be on macos now.

By the way: yourmachine_ip_address can be a third machine with sshd access, which you own and with public IP address. Than in last step you would connect with it this way:

yourlocalmachine$ ssh -p 65022 root@<yourmachine_ip_address>

WARNING: I'm not 100% sure it will work (I haven't tested it yet), but it's interesting - I will try it as soon as I get back home :)

UPDATE: I've tested it - it works like a charm.

UPDATE 2: In second case (when we use third machine), GatewayPorts yes has to be set in /etc/sshd/sshd_config file on this machine.